FortiOS and Fortinet: Major Vulnerabilities and Security Best Practices

Fortinet FortiGate appliances are deployed in tens of thousands of enterprises worldwide. Perimeter firewalls, SSL VPN concentrators, SD-WAN solutions — their direct internet exposure makes them prime targets for attackers. Here is the state of critical CVEs and the measures to take.

Why FortiOS is Particularly Targeted

Three reasons explain attacker interest in FortiGate:

1. Direct internet exposure — FortiGates are by definition on the network perimeter
2. Elevated privileges — compromising a firewall gives access to all network traffic
3. Patching difficulty — FortiOS updates require maintenance windows and can impact production

Major FortiOS CVEs

CVE-2024-21762 — SSL VPN RCE (CVSS 9.6)

One of the most critical vulnerabilities of 2024. An out-of-bounds write in the SSL VPN component allowed arbitrary remote code execution without authentication.

Affected versions: FortiOS 7.4.0-7.4.2, 7.2.0-7.2.6, 7.0.0-7.0.13, 6.4.0-6.4.14
Fixed versions: 7.4.3+, 7.2.7+, 7.0.14+, 6.4.15+
Status: Actively exploited — CISA KEV

CVE-2024-55591 — FortiOS Auth Bypass (CVSS 9.6)

Authentication bypass via the Node.js WebSocket interface, allowing an attacker to create a super-admin without valid credentials.

Affected versions: FortiOS 7.0.0-7.0.16
Fixed versions: 7.0.17+

CVE-2023-27997 — SSL VPN Heap Overflow (CVSS 9.8)

A heap overflow in the SSL VPN daemon enabling pre-authenticated code execution. Nicknamed "XORtigate" in the security community. Affected FortiGates with SSL VPN enabled.

Fixed versions: 6.0.17, 6.2.15, 6.4.13, 7.0.12, 7.2.5, 7.4.0+

CVE-2022-42475 — SSL VPN Heap Buffer Overflow (CVSS 9.3)

Exploited as a zero-day before patch publication, notably by state-sponsored actors (attributed to UNC3886 by Mandiant). Allowed code execution via the SSL VPN component.

CVE-2022-40684 — Auth Bypass (CVSS 9.6)

Authentication bypass in the HTTP/HTTPS management interface. Allowed an attacker to perform admin operations via crafted HTTP requests. Exploited en masse before Fortinet published its advisory.

Continuously Monitor FortiOS CVEs

The frequency of critical FortiOS CVEs demands permanent monitoring. On cveo.tech, you can:

1. Search for fortios or FortiGate to see all associated CVEs
2. Register your FortiOS version in your asset inventory
3. Receive automatic alerts as soon as a new CVE affects you

FortiGate Hardening Best Practices

Disable SSL VPN if Not in Use

If you don't use SSL VPN, disable it — it's the most exploited attack surface:

config vpn ssl settings
    set status disable
end

Restrict Access to the Management Interface

Never expose the management interface on the WAN interface:

config system interface
    edit "wan1"
        set allowaccess ping  # Remove https, ssh, http
    next
end

Enable Automatic Signature Updates

config system autoupdate schedule
    set status enable
    set frequency daily
end

Segment SSL VPN Traffic

Use split tunneling with strict policies rather than full-tunnel access, and enable multi-factor authentication on all SSL VPN access.

Check Post-Exploitation IOCs

After a major vulnerability, Fortinet publishes IOCs to search for in logs. Check specifically for:

• Suspicious local account creation
• Firewall policy modifications
• SSL VPN connections from unusual IPs

Recommended Patching Process

1. Subscribe to Fortinet advisories: psirt.fortinet.com
2. Qualify versions in a test environment before production
3. Plan maintenance windows — FortiOS can be updated in under 10 minutes
4. Document versions of each appliance — essential for rapid response

Add your Fortinet equipment to your asset inventory on cveo.tech and receive an alert as soon as a new CVE affects you.